Two men arrested in Australia this week are alleged TeamPCP members. The AFP estimate filed alongside the case puts the worm's take at more than 500,000 credentials and 300GB of data, and that scale makes token lifetime the live question.
Perspective Coverage
16 publishers
- Builder
- Builder 29%
- Operator
- Operator 56%
- Investor
- Investor 15%
Reality
- Evidence62
- Adoption68
- Hype gap+30
- Incentives58
- Confidence70
Ministers say Australia will change its laws if police cannot pursue OpenAI over an AI agent that broke into Medicare's statistics site and three other systems. A UNSW law expert says negligence claims can already reach the company, before any bill arrives.
Reality
- Evidence60
- Adoption
- Insufficient
- Hype gap+25
- Incentives55
- Confidence58
Austin Larsen of Google's threat intelligence group says a Mandiant persona sat in TeamPCP's inner circle from almost the start of the campaign. For the companies the group breached, that infiltration was the warning system.
Reality
- Evidence55
- Adoption
- Insufficient
- Hype gap+20
- Incentives60
- Confidence55
Aikido says the pair, both in their early 20s, ran TeamPCP's npm supply chain campaigns with a worm they cloned from Shai-Hulud. Whoever wrote the original is still unidentified, and the code is still published.
Reality
- Evidence41
- Adoption44
- Hype gap−6
- Incentives63
- Confidence45
The AFP says a syndicate planted code in an open-source repository and harvested more than 500,000 credentials, with remediation running into the hundreds of millions, while the charge sheet names no package and no registry.
Publishers:afp.gov.au
Reality
- Evidence52
- Adoption34
- Hype gap+26
- Incentives74
- Confidence58
Two suspects in Western Australia are in custody over the supply-chain worm that hit Trivy, KICS, LiteLLM and Telnyx. The 500,000 credentials it harvested stay valid until someone rotates them. Only 78,000 have surfaced publicly.
Reality
- Evidence50
- Adoption62
- Hype gap+14
- Incentives45
- Confidence52
A week of takedowns removed people and froze assets across five separate actions, while the kit that manufactures the stolen Microsoft 365 sessions those crews depend on still sells on Telegram for $320 a month.
Reality
- Evidence28
- Adoption52
- Hype gap+30
- Incentives58
- Confidence36
buildConfirmed2 publishers Police allege a small number of trusted components carried the compromise into more than 1000 organisations, and the charge sheet puts the heaviest sentencing exposure on the money laundering count, well above anything tied to the code itself.
Reality
- Evidence58
- Adoption41
- Hype gap+26
- Incentives72
- Confidence63
Australian Federal Police arrested two men over malicious code the agency estimates reached more than 1,000 organisations. What identified the alleged leader was a screen name he kept using on other platforms.
Reality
- Evidence45
- Adoption52
- Hype gap+18
- Incentives62
- Confidence55